Digital & AI
Regulation (EU) 2024/1183
eIDAS 2
European Digital Identity Framework
A European digital identity wallet: you prove who you are — and only the attribute needed — to public services and to many private relying parties, without a new password zoo.
Does this hit me?
A state-backed wallet on your phone, voluntary to use. You should be able to log into many services without handing over the full document. It is not a social-credit score.
Check in the wizardPick a country in the header to see who enforces this at home. Union text is not the last word for directives.
How it rolls in
May 2024
Framework entered into force.
2026
Wallets to be provided; implementing acts on the architecture.
2027
Broader relying-party acceptance clocks.
Why it exists
eIDAS 1 made national eIDs recognisable. It did not give people a wallet they control, or force banks and big platforms to accept it.
What actually changes
- Each Member State must provide at least one European Digital Identity Wallet.
- Qualified electronic attestation of attributes (diplomas, licences, company roles).
- Private relying parties in listed sectors (including banking, telecoms, very large platforms) must accept the wallet where they already require strong identification.
- Selective disclosure: show ‘over 18’, not the whole ID card.
How it hits you
A state-backed wallet on your phone, voluntary to use. You should be able to log into many services without handing over the full document. It is not a social-credit score.
For citizens
What this does to everyday life
Rights, bills, and what you can ignore. You are usually not the one who files — companies and states are.
A wallet that shows ‘over 18’, not your whole life
Member States must offer a European digital identity wallet. You choose to use it. A shop or bank that already demands strong ID should accept it without vacuuming the full document.
Rights you actually get
- Voluntary use
- Selective disclosure
- A complaint to the national eIDAS/DPA mix if extra data is forced
Costs and trade-offs
- Another app, if you opt in. It should not become the only door to public services overnight.
What you can do
- Use the national wallet when it is offered.
- Refuse extra attributes that are not needed for the service.
What you can ignore
- You are not fined for not installing it.
If something goes wrong
National eID helpdesk; data protection authority if a relying party over-collects.
More citizen notes across files: For people
Heard this? Not quite.
Claim: Brussels will hold a file on every citizen.
The wallet is designed to be user-controlled with selective disclosure. Member States issue; the Commission writes the technical rulebook.
Latest official statements
All EU NewsNo tagged Commission, Parliament or Council statement in the current feeds.
Board one-pager
Board one-pager
Who this is for: EU digital, product and data teams. Regulation (EU) 2024/1183. Member States must offer a wallet; relying parties phase in from 2026–2027.
Scope
- You require strong identification of EU customers (banks, telecoms, VLOPs) or you issue identity/attribute attestations.
First 90 days
- This quarter: Inventory where you currently require eIDAS, video-KYC, or a passport scan.
- This year: Wallet-acceptance architecture and data-minimisation of the onboarding form.
Penalties: eIDAS supervisory-body measures; GDPR on over-collection; sector AML if KYC is wrong.
For companies
How to stay on the right side of this file
Practical order of work, not a substitute for counsel. Member State wallet issuers and private relying parties that already require strong identification.
You are probably
Member State wallet issuers and private relying parties that already require strong identification.
Effort
A scoped programme this year beats a scramble at the apply-date.
Budget
SME: owner time plus one honest vendor. Large: a named lead, not a taskforce slide.
Roles in this file
The same company can wear more than one hat. Classify before you buy a tool.
Product + compliance
This pack names Product + compliance as an owner of early work.
Inventory where you currently require eIDAS, video-KYC, or a passport scan.
IT
This pack names IT as an owner of early work.
Wallet-acceptance architecture and data-minimisation of the onboarding form.
Are you in scope?
This year's work- You require strong identification of EU customers (banks, telecoms, VLOPs) or you issue identity/attribute attestations.
Usually not, if
- A shop that never identifies the customer beyond an email.
First moves
- This quarterInventory where you currently require eIDAS, video-KYC, or a passport scan.Product + compliance
- This yearWallet-acceptance architecture and data-minimisation of the onboarding form.IT
- If you are not a bank, telco or large platform, you may still choose to accept the wallet — it can cut onboarding cost.
If you skip this
- Storing the full PID when the use-case only needed age.
Done looks like
- Relying-party registration
- Attribute matrix
- DPIA on wallet flows
Keep this evidence
- Relying-party registration
- Attribute matrix
- DPIA on wallet flows
Ask vendors
- Are you a certified wallet or a relying-party integrator? Which implementing acts do you support?
Where programmes usually break
- Storing the full PID when the use-case only needed age.
Call counsel when
- eIDAS supervisory-body measures; GDPR on over-collection; sector AML if KYC is wrong.
- A supervisor letter, a dawn information request, or a deal that warrants this file.
Enforcement
eIDAS supervisory-body measures; GDPR on over-collection; sector AML if KYC is wrong.
National eIDAS supervisory bodies; Commission on the technical toolbox.
Need a stack, not one file? Open the company desk
Professional briefing
Legal architecture and duties
For counsel, compliance, and policy teams. Not advice. The Official Journal still wins.
- Instrument
- Regulation
- Legal basis
- Art 114 TFEU · Regulation (EU) 2024/1183
- Application
- In force; wallet provision and relying-party clocks sit in the regulation and implementing acts (2026–2027).
From recognisable national eIDs to a user-controlled wallet and private-sector acceptance. Selective disclosure is the design promise — over-collection is the GDPR residual risk.
How the file is built
Wallet
Member State-provided EUDI wallet; certified, with PID and attestations.
Relying parties
Listed sectors must accept where they already require strong ID.
Operators
| Role | Who | Core duties |
|---|---|---|
| Wallet provider / Member State | Issues the wallet. | Free core use, security, unbundling. |
| Relying party | Banks, telcos, VLOPs, public services. | Accept, minimise attributes, register where required. |
Scope
Union; cross-border recognition is the point.
In
- Electronic identification, wallets, qualified trust services, attestations of attributes
Out, or narrower than assumed
- Optional for natural persons to use
- Use-cases that never required strong ID
Operative provisions
| Anchor | Rule | What it does in practice |
|---|---|---|
| Wallet titles of 2024/1183 | Provision, certification, acceptance. | Build the relying-party integration on attributes, not document scans. |
Secondary law and guidance
- Toolbox and implementing acts on architecture, PID, attestations
National layer. Wallet issuance and eID means remain national. Supervisory bodies are national.
How it sits with other files
Enforcement and private rights
Who
eIDAS supervisory bodies; DPAs; DSA/Commission for VLOPs.
Tools
Certification withdrawal, orders, GDPR fines.
Private rights
Data-subject rights; consumer law on forced extra attributes.
Risk register
| Risk | Signal | Control |
|---|---|---|
| Full-PID hoarding | Onboarding still stores a passport image | Attribute matrix per use-case. |
Open issues
- Implementing-act timing.
- Offline use.
- Private wallets vs state wallets.
Primary sources
A European digital identity wallet: you prove who you are — and only the attribute needed — to public services and to many private relying parties, without a new password zoo.
You feel it now
This is a this-year file.
Next
Member States must offer a wallet; relying parties phase in from 2026–2027
Where it lands
| Channel | People | Companies |
|---|---|---|
| Acceptance duty | A state-backed wallet on your phone, voluntary to use. You should be able to log into many services without handing over the full document. It is not a social-credit score. | Listed relying parties must accept the wallet where they already demand strong ID. |
| Selective disclosure | A state-backed wallet on your phone, voluntary to use. You should be able to log into many services without handing over the full document. It is not a social-credit score. | Redesign KYC so you ask for an attribute, not a full document scan. |
Who gains
People who are tired of sending a scan of a passport to rent a scooter.
Who pays
States (issuance) and relying parties (integration).
Who pays
States (issuance) and relying parties (integration).
Who benefits
People who are tired of sending a scan of a passport to rent a scooter.
Read the official text